# Elastic pipeline processors grok for question!

**URL:** <https://discuss.elastic.co/t/elastic-pipeline-processors-grok-for-question/333852>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [May 19, 2023, 9:13am UTC](https://discuss.elastic.co/t/elastic-pipeline-processors-grok-for-question/333852 "2023-05-19T09:13:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Teresajw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/teresajw/32/119937_2.png) [@Teresajw](https://discuss.elastic.co/u/Teresajw)\
**Post date:** [May 19, 2023, 9:13am UTC](https://discuss.elastic.co/t/elastic-pipeline-processors-grok-for-question/333852/1 "2023-05-19T09:13:51Z")

</div>

When I parsed the nginx log using Filebeat pipeline, a user\_agent field in the log failed to be parsed. The following error is displayed.

**{"type":"mapper\_parsing\_exception","reason":"object mapping for [user\_agent] tried to parse field [user\_agent] as object, but found a concrete value**

```auto
5月 19 17:00:03 k8s-node-01 filebeat[10542]: 2023-05-19T17:00:03.025+0800 WARN [elasticsearch] elasticsearch/client.go:414 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2023, time.May, 19, 17, 0, 2, 574674762, time.Local), Meta:null, Fields:{"agent":{"name":"k8s-node-01"},"ecs":{},"fields":{"log_type":"gate"},"host":{"name":"k8s-node-01"},"input":{},"log":{"file":{"path":"XXXX.log"}},"message":"client_address:XXXX###client_user:-###real_ip:-###visit_time:2023-05-19T15:48:59+08:00###request_uri:POST /xxx/xxx/xxx HTTP/1.1###request_host:xxxx###http_status:200###upstream_status:200###traffic:76###original_address:xxxx###user_agent:Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.29(0x18001d38) NetType/4G Language/zh_CN###request_length:637###load_balancer:172.16.50.94:32007###processing_time:0.044###upstream_response_time:0.044###http_acl_t:-###","tags":["xxx"]}, Private:(*input_logfile.updateOp)(0xc0023c9580), TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [user_agent] tried to parse field [user_agent] as object, but found a concrete value"}, dropping event!

```

1. pipeline

```auto
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description" : "log_pipeline",
    "processors" : [
      {
        "grok" : {
          "field" : "message",
          "patterns" : [
            """%{WORD:client_address}:%{IP:client_address}###%{WORD:client_user}:%{DATA:client_user}###%{WORD:real_ip}:%{DATA:real_ip}###%{WORD:visit_time}:%{TIMESTAMP_ISO8601:visit_time}###%{WORD:request_uri}:%{GREEDYDATA:request_uri}###%{WORD:request_host}:%{DATA:request_host}###%{WORD:http_status}:%{NUMBER:http_status}###%{WORD:upstream_status}:%{NUMBER:upstream_status}###%{WORD:traffic}:%{NUMBER:traffic}###%{WORD:original_address}:%{DATA:original_address}###%{WORD:user_agent}:%{GREEDYDATA:user_agent}###%{WORD:request_length}:%{NUMBER:request_length}###%{WORD:load_balancer}:%{DATA:load_balancer}###%{WORD:processing_time}:%{NUMBER:processing_time}###%{WORD:upstream_response_time}:%{NUMBER:upstream_response_time}###%{WORD:http_acl_t}:%{DATA:http_acl_t}###"""
          ],
          "ignore_failure" : true
        }
      },
      {
        "date" : {
          "field" : "visit_time",
          "target_field" : "@timestamp",
          "formats" : ["ISO8601"],
          "timezone" : "Asia/Shanghai"
        }
      },
      {
        "geoip": {
        "field": "client_address",
        "ignore_failure": true
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": """client_address:XXXX###client_user:-###real_ip:-###visit_time:2023-05-19T15:48:59+08:00###request_uri:POST /xxx/xxx/xxx HTTP/1.1###request_host:xxxx###http_status:200###upstream_status:200###traffic:76###original_address:xxxx###user_agent:Mozilla/5.0 (iPhone; CPU iPhone OS 15_7_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/8.0.29(0x18001d38) NetType/4G Language/zh_CN###request_length:637###load_balancer:172.16.50.94:32007###processing_time:0.044###upstream_response_time:0.044###http_acl_t:-###"""
      }
    }
  ]
}

```

**However, the kibana console tested the pipeline without any problems, it was parsed successfully, and started filebeat parsing with an error**

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/aff70cdea8663bde086cfd4f47b92d0208543ec6.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/3/6342888379d34e000ebfab3334e499f63e77221a.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2023, 9:14am UTC](https://discuss.elastic.co/t/elastic-pipeline-processors-grok-for-question/333852/2 "2023-06-16T09:14:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.